220-1202 Documentation and Change Management Practice Test 2 — 15 Questions

Question 1

A customer calls the help desk complaining that their printer no longer works after a technician installed a security update on their computer. The technician checks the documentation and finds no record of the update being installed. What is the most likely cause of the missing documentation?

Accepted Answer

The security update was applied automatically by Windows Update.. The most likely cause is that the security update was applied automatically by Windows Update. In many corporate environments, Windows Update is configured to install critical patches automatically without requiring manual intervention or logging in the technician's change documentation. This explains why the technician found no record of the update, even though it was installed and caused the printer driver to stop functioning.

Answer

The printer driver was corrupted by a virus.

Answer

The technician forgot to save the change log before leaving for the day.

Answer

The customer accidentally deleted the update history.

Question 2

A customer reports that after a recent software update, their accounting application crashes every time they try to generate a report. The technician checks the change log and finds no record of any update being approved for that application. What should the technician do first?

Accepted Answer

Document the unauthorized change and escalate it to the change advisory board.. The technician found an unauthorized change (the update) with no approval record. The first step in change management is to document and escalate the unauthorized change to the Change Advisory Board (CAB) to assess impact, determine root cause, and authorize remediation. Restoring or reinstalling without CAB approval could violate change control policies and introduce additional risks.

Answer

Restore the application from the last known good backup.

Answer

Uninstall the update and reinstall the previous version of the application.

Answer

Contact the software vendor to request a patch for the crash.

Question 3

A technician is documenting a configuration change to a firewall rule that allows remote access for a new employee. The technician must ensure the documentation is clear for future audits. Which of the following is the most critical piece of information to include?

Accepted Answer

The business justification for the rule.. Option C is correct because change management documentation must include the business justification to demonstrate that the change was authorized and necessary. Without a clear reason, auditors cannot verify that the firewall rule complies with organizational security policy or regulatory requirements. The business justification provides the context needed to distinguish legitimate changes from unauthorized or malicious modifications.

Answer

The exact date and time the rule was added.

Answer

The IP address of the new employee's remote location.

Answer

The name of the technician who made the change.

Question 4

During a routine security audit, a technician discovers that a server was patched out of the approved maintenance window. The patch was applied by a junior admin who was not authorized. What is the most important step to include in the incident documentation?

Accepted Answer

The reason the patch was applied outside the maintenance window.. The most important step in incident documentation is to capture the reason the patch was applied outside the approved maintenance window. This directly addresses the root cause of the unauthorized change, which is critical for post-incident review, process improvement, and preventing recurrence. Without the reason, the documentation fails to support a meaningful root cause analysis (RCA) and corrective action planning.

Answer

The name of the junior admin who applied the patch.

Answer

The exact time the patch was applied.

Answer

The patch's version number and source.

Question 5

A technician is tasked with upgrading the operating system on ten identical workstations. The change advisory board has approved the upgrade. After completing the first workstation, the technician notices the new OS causes a critical line-of-business application to fail. What should the technician do next?

Accepted Answer

Report the failure to the change advisory board and pause further upgrades.. This question tests the change management process when an approved change causes unexpected issues. The correct action is to stop the rollout and document the problem so the CAB can reassess the change.

Answer

Continue upgrading the remaining workstations since the change was approved.

Answer

Restore the first workstation to the previous OS and complete the rest without changes.

Answer

Research a hotfix for the application and apply it to all workstations.

Question 6

A user reports that their workstation cannot connect to the company file server after a scheduled network maintenance window last night. The technician checks the change management records and finds no mention of any changes to the file server. What is the most likely cause of the issue?

Accepted Answer

The maintenance window affected a network switch that the file server relies on. The scheduled network maintenance window is the key clue: it likely involved changes to network infrastructure such as switches, routers, or VLAN configurations. If a network switch that the file server depends on was modified or rebooted during maintenance, the workstation would lose connectivity even though the file server itself was untouched. Change management records only track changes to the file server, not to network devices, so the absence of file server changes does not rule out a network-level cause.

Answer

The file server requires a firmware update

Answer

The user’s account password has expired

Answer

The file server’s hard drive has failed

Question 7

A small business has no formal change management process. A technician installs a new antivirus program on a server, which later conflicts with the existing backup software, causing backups to fail. Which principle of change management was most clearly violated?

Accepted Answer

The change was not documented or communicated to stakeholders. The scenario describes a small business with no formal change management process. The core failure is that the technician installed new antivirus software without documenting the change or communicating it to stakeholders (such as the backup administrator or other IT staff). If the change had been documented and communicated, the potential conflict with the existing backup software could have been identified and avoided. This directly violates the principle that all changes must be documented and communicated to relevant parties, even in the absence of a formal CAB or staging environment.

Answer

The change was not tested in a staging environment

Answer

The change was not approved by the change advisory board

Answer

The technician did not create a rollback plan

Question 8

A technician is updating the documentation for a network printer that was moved to a different floor. The technician updates the asset tag in the inventory system. Which additional documentation should the technician also update to ensure accurate records?

Accepted Answer

The network diagram showing device locations and connections. When a network printer is moved to a different floor, its physical location and network connectivity change. The network diagram is the authoritative document that records device locations, switch ports, IP addresses, and cabling paths. Updating it ensures that troubleshooting, asset tracking, and future moves remain accurate, directly supporting change management and documentation best practices.

Answer

The user manual for the printer

Answer

The company’s acceptable use policy

Answer

The printer’s warranty information

Question 9

A company’s change management policy states that all changes must be reviewed by the CAB. An urgent security vulnerability is discovered that requires an immediate patch to a critical database server. The CAB is not available for 24 hours. What is the best course of action?

Accepted Answer

Apply the patch immediately and document it as an emergency change. Option B is correct because the change management policy includes an emergency change process for urgent security vulnerabilities. Applying the patch immediately and documenting it as an emergency change aligns with ITIL best practices and the company's policy, ensuring the vulnerability is mitigated without delay while maintaining compliance through post-implementation review.

Answer

Wait for the CAB to meet and approve the change

Answer

Apply the patch but do not document it to avoid policy violation

Answer

Disconnect the server from the network until the CAB meets

Question 10

A technician is tasked with replacing a faulty power supply in a desktop computer that is part of a critical patient record system at a clinic. Before starting, the technician reviews the change management policy. Which step should the technician perform first?

Accepted Answer

Submit a change request to the change advisory board (CAB). Option B is correct because the change management policy requires that any modification to a system handling critical patient records must first be formally approved via a change request submitted to the Change Advisory Board (CAB). This ensures that risks are assessed, downtime is scheduled, and compliance with healthcare data regulations (e.g., HIPAA) is maintained before any physical work begins.

Answer

Power off the workstation and disconnect all cables

Answer

Back up the patient records to an external drive

Answer

Notify the clinic staff that the system will be offline

Question 11

A technician is preparing to deploy a security patch to 50 workstations. The change request has been approved, and the patch has been tested on a pilot group. During the deployment, five workstations fail to install the patch. What should the technician do next according to change management best practices?

Accepted Answer

Halt the deployment and execute the rollback plan for the failed workstations. According to change management best practices, when a deployment encounters failures, the immediate priority is to halt the deployment to prevent further issues and then execute the rollback plan to restore the failed workstations to their previous known-good state. This ensures stability and minimizes disruption, as the rollback plan was already defined and approved as part of the change request. Continuing or forcing the patch could lead to system instability or security vulnerabilities.

Answer

Continue deploying to the remaining workstations and troubleshoot the failures later

Answer

Force the patch to install using administrative tools

Answer

Submit a new change request for the failed workstations

Question 12

A help desk technician receives a complaint that a user’s custom software application stopped working after a Windows update was installed automatically overnight. The technician checks the system and finds the update is not in the approved change log. What should the technician do next?

Accepted Answer

Roll back the Windows update and document the incident. Option B is correct because the update was installed without authorization (not in the approved change log), violating change management policy. The technician should immediately roll back the update to restore application functionality and then document the incident to ensure proper change control procedures are followed. This aligns with the CompTIA A+ change management process: identify the unauthorized change, reverse it, and report it.

Answer

Reinstall the custom application immediately

Answer

Leave the update in place and submit a new change request for the application

Answer

Disable Windows Update on the workstation permanently

Question 13

A technician is reviewing the change management log and finds that a previous change to the email server was marked as 'completed' but the email service has been intermittent since then. The technician suspects the change was not fully tested. Which step in the change management process was most likely skipped?

Accepted Answer

A post-implementation review was not conducted. Option C is correct because a post-implementation review (PIR) is the step where the change is verified to have met its objectives without causing adverse effects. Since the email service became intermittent after the change was marked 'completed', the lack of a PIR means the change was not validated in production, allowing the underlying issue to go undetected. In the CompTIA change management process, the PIR ensures that the change has been fully tested and that any residual problems are identified and addressed before the change is closed.

Answer

The change request was not submitted

Answer

The change was not approved by the CAB

Answer

The rollback plan was not documented

Question 14

A small business is deploying a new accounting application across five workstations. The IT lead creates a detailed change request that includes the purpose, scope, risk assessment, and rollback plan. Which document should the IT lead update immediately after the deployment is successfully completed?

Accepted Answer

The change request form. The change request form is the central document that tracks the entire lifecycle of a change, including planning, approval, implementation, and post-implementation review. Once the deployment is successfully completed, the IT lead must update the change request form to mark it as 'Closed' or 'Completed,' documenting the actual outcome, any deviations, and the final status. This ensures an accurate audit trail for compliance and future troubleshooting, as required by ITIL-based change management processes.

Answer

The firewall configuration log

Answer

The employee handbook

Answer

The backup verification checklist

Question 15

A company’s change management policy requires that all changes be categorized as standard, emergency, or normal. During a server migration, a technician discovers a critical security patch must be applied immediately to prevent a data breach. Which type of change should the technician request?

Accepted Answer

Emergency change. The scenario describes a critical security patch that must be applied immediately to prevent a data breach, which aligns with the definition of an emergency change. Emergency changes are pre-approved or fast-tracked to address urgent threats or service outages, bypassing the normal change advisory board (CAB) review process. This ensures the patch can be deployed without delay to mitigate the risk.

Answer

Standard change

Answer

Normal change

Answer

Service request